Your Data, Professionally Protected

What is the ICO?

The Information Commissioner's Office (ICO) is the United Kingdom's independent authority set up to uphold information rights in the public interest. It is the UK's official data protection regulator, established under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

The ICO has the legal power to investigate organisations, issue fines, and take enforcement action against those who mishandle personal data. When a company registers with the ICO, it makes a public commitment to handle personal data lawfully, fairly, and transparently.

In simple terms: the ICO is the government body that makes sure companies treat your personal information properly. If a company breaks the rules, the ICO can fine them up to millions of pounds.

What Does ICO Registration Mean for You?

Being registered with the ICO means Roleplay Project — operated by Phytoventures Ltd — is legally accountable for how we handle your data. This is not optional for us; it is a legal requirement under UK law. Here's what that means in practice:

How We Protect Your Data

We don't just meet the minimum requirements — we take active steps to keep your information safe:

• Password Security — All passwords are hashed using bcrypt, an industry-standard algorithm. We never store your password in plain text. Even if our database were compromised, your password would remain protected.
• SSL/TLS Encryption — All connections to our website and User Control Panel are encrypted using HTTPS. Your data is protected in transit between your browser and our servers.
• Minimal Data Collection — We only collect the data we need to operate the service. We don't harvest your personal information for advertising, analytics profiling, or sale to third parties.
• No Third-Party Data Sales — Your data is never sold, rented, or shared with advertisers or marketing companies. Period.
• Data Retention Limits — We don't keep your data forever. Connection logs are deleted after 12 months, chat logs after 6 months, and account data within 12 months of account deletion.
• Access Controls — Only authorised personnel can access user data, and only when necessary for server administration or responding to support requests.

Your Rights Under UK GDPR

As a user, you have powerful legal rights over your personal data. These aren't just our policies — they are your legal rights under UK law:

• Right of Access — You can request a copy of all personal data we hold about you. We must provide it within 30 days.
• Right to Rectification — If any data we hold about you is incorrect, you can ask us to correct it.
• Right to Erasure — You can ask us to delete your personal data entirely. Also known as the "right to be forgotten."
• Right to Restrict Processing — You can ask us to stop using your data in certain ways while keeping it stored.
• Right to Data Portability — You can request your data in a commonly used, machine-readable format.
• Right to Object — You can object to the processing of your personal data for specific purposes.
• Right to Complain — If you believe we have mishandled your data, you can lodge a complaint directly with the ICO.

How We Compare to Other Servers

Most roleplay servers are run by anonymous individuals with no legal obligations to protect your data. Here's how Roleplay Project stands apart:

Why Being Operated by a Registered Company Matters

Roleplay Project is not run by an anonymous person behind a screen name. It is operated by Phytoventures Ltd, a company registered with Companies House in England and Wales. This means:

• Real accountability. Phytoventures Ltd is a legal entity with directors, a registered office, and public filings. If something goes wrong, there is a real company you can hold accountable — not an anonymous Discord username.
• Legal obligations. As a registered company, Phytoventures Ltd is subject to UK company law, data protection law, consumer law, and regulatory oversight. We cannot simply disappear or ignore our responsibilities.
• Professional standards. Running a server through a registered company means we treat this as a professional operation. Server infrastructure, data handling, financial transparency — all held to a higher standard than hobby projects.
• Financial transparency. Registered companies must file annual accounts and confirmation statements with Companies House. Our company information is publicly available and verifiable.
• Long-term commitment. A registered company signals investment in the project's future. We are not going to vanish overnight — we have legal and financial obligations that ensure continuity.

What Data Do We Actually Collect?

We believe in transparency. Here is exactly what we collect and why:

Account Data

When you register, we collect your chosen username and password (stored as a bcrypt hash). This is the minimum required to create and secure your account.

Connection Data

When you connect to the server, we log your IP address and connection timestamps. This is used for security purposes only — detecting ban evasion, preventing attacks, and investigating abuse. Connection logs are automatically deleted after 12 months.

Gameplay Data

Character information, in-game assets, chat messages, and transaction records are stored to operate the game server. Chat logs are automatically deleted after 6 months.

Website Data

We use strictly necessary cookies only — no tracking cookies, no analytics cookies, no advertising cookies. We do not use Google Analytics or any third-party tracking tools on our website.

Contact the ICO

If you believe your data has been mishandled, you have the right to lodge a complaint with the Information Commissioner's Office. You do not need our permission to do this.